Michael Schroeder

It's not wrong at all. The md5 sums are used as better crc function, not in a cryptographic sensitive way.

(But yes, something like xxhash would have been a better choice. But it didn't exist at that time.)

(And please do not forget that deltarpm was written in 2005...)

Yeah, changing the message so that it no longer mentions md5 is certainly a good idea. Regarding rpm upstream: see https://github.com/rpm-software-management/rpm/issues/1292

The error seems to come from writedeltarpm.c line 173, the cfile_open of the target payload seems to fail for some reason (out of memory?). (Note that you can limit memory...

[back from vacation] Ok, I think I need your two rpms to reproduce it locally. Can you please upload them to some place where I can access them?

Ok, downloaded them and ran makedeltarpm: ``` $ makedeltarpm -v ovirt-engine-appliance-4.2-20180731.1.el7.noarch.rpm ovirt-engine-appliance-4.2-20180903.1.el7.noarch.rpm ovirt.drpm reading new rpm... reading old rpm... files used: 3/3 = 100.0% files skipped: 0/3 = 0.0% creating...

Just a data point: when I created ndb I played with putting lzo compressed headers in the database. I thought that decompression would be faster than IO, so the net...

This somehow slipped my radar. The "time" used in rpm is not supposed to be the key creation time, but the last time the key was changed. I don't think...

I.e. pgpDigParamsCreationTime() is somewhat misnamed, it does not the key creation time.